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REMARKS 

The Examiner has rejected Claims 1-4, 7-24, and 26-29 under 35 U.S.C 1 03(a) as being 
unpatentable over Redlich (USPN 6,591,306) in view of Belissent (USPN 6,789,203). Applicant 
respectfully disagrees with such rejection. 

Specifically, the Examiner now relies on col. 2, lines 13-38; figure 2, item 202; col. 5, lines 
62-67; col. 6, lines 1-56; and col. 7, lines 1-17 from Belissent to make aprior art showing of 
applicant's claimed "if it is determined that an attack is not consuming significant resources, slowing 
down the forwarding of said request short of stopping the same, and if it is determined that an attack 
is consuming significant resources, stopping the forwarding of said request." 

Applicant respectfully disagrees with this assertion. After careful review of the foregoing 
Belissent excerpts, as well as the remaining Belissent reference, it is clear that Belissent merely 
discloses the throttling of incoming requests. In sharp contrast, applicant teaches and claims the 
throttling, as claimed, in the specific context of forwarding requests from a public host to a secret 
host. 

Despite such deficiencies and in the spirit of expediting the prosecution of the present 
application, applicant has incorporated the subject matter of Claims 11-12, and 30/31 et al. (or 
substantially similar, but not identical, language) into each of the independent claims. It should be 
noted that some clarifications have been made to avoid antecedent basis issues, etc. 

The Examiner now relies on col. 25, lines 12-67 from Redlich and col. 6, lines 18-67 from 
Belissent, respectively, to make a prior art showing of applicant's claimed <c wherein a notification 
that the public host is under attack is received at the secret host" (see former Claim 11, now 
substantially incorporated into each of the independent claims), and "wherein a notification that the 
public host is congested is received at the secret host" (see former Claim 12, now substantially 
incorporated into each of the independent claims). 
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Applicant respectfully disagrees with this assertion. For example, after reviewing the above 
excerpt from Redlich, there is not even a mention of a technique for dealing with an attack, let alone 
applicant's claimed notification that the public host is unde r attack Tthafl is received at the secret 
host . Still yet, after reviewing the above excerpt from Belissent, there is not even a mention of a 
secret host, let alone a notification that the public host is co ngested fthatl is received at the secret 
host. 



Still yet, the Examiner references the rejection of Claim 22 to make a prior art showing of 
applicant's claimed "wherein, after stopping the forwarding of said packets, said secret node requests 
that the DNS server replace the IP address for the public node with an IP address of an alternate Post 
Office Box Internet Protocol (POBIP) node, and attempts to track down a source of the attack" (see 
former Claim 30, now substantially incorporated into at least a portion of the independent claims), 
and 4< wherein, after stopping the forwarding of said request, said secret host notifies select clients of 
an address of an alternate Post Office Box Internet Protocol (POBIP) node, and attempts to track 
down a source of the attack" (see former Claim 31, now substantially incorporated into at least a 
portion of the independent claims). 

Applicant respectfully disagrees. It is noted, first, that the subject matter of Claim 22 simply 
does not reflect the foregoing subject matter of Claims 30 and 31. Thus, applicant is puzzled that the 
Examiner has referenced the rejection of Claim 22 to meet such claim limitations. Further, after 
careful review of both the Redlich and Belissent references, it is clear that there is no "secret node 
[that] requests that the DNS server replace the IP address for the public node with an IP address of an 
alternate Post Office Box Internet Protocol (POBIP) node, and attempts to track down a source of the 
attack" nor a "secret host [that] notifies select clients of an address of an alternate Post Office Box 
Internet Protocol (POBIP) node, and attempts to track down a source of the attack" under the specific 
claimed condition, namely after stopping the forwardine of said packets . There is simply no such 
claimed action under such specific claimed condition. 

For example, the only mention of any "alternate" communication in Redlich is a mere 
suggestion regarding the creation of additional secure tunnels to other trusted routers in the Internet 
Such additional tunnels are used as alternative routes for outbound traffic , and, in no way, occur after 
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sto pping the forwarding of said packets, as a result of a secret node request to a DNS server or a 
notification from the secret host to select clients, etc. 

It noted further noted that the Examiner relies on col. 8, line 42 - col. 9, line 24 from 
Shostack to meet applicant's claimed "after the attack has stopped, the address of the alternate Post 
Office Box Internet Protocol (POBIP) node is replaced with the public host address" (see this or 
similar language in each of the independent claims). Moreover, the Examiner specifically relies on 
Shostack's alleged disclosure of "a push mechanism that utilizes a POP mail server to hold mail for 
the user in the public network (node) and alternatively the mail will be push[ed] onto the user's local 
computer." 

Applicant, again, respectfully disagrees with this assertion. Even if Shostack does indeed 
disclose a push mechanism, as set forth above, after careful review of the foregoing excerpts from 
Shostack, it is clear that there is simply not even a suggestion of a technique where the address of the 
alternate Post Office Box Internet Protocol (POBIP) node is replac ed with the public host address, 
under the specifically claimed condition, namely after the attack has stopped. 

Thus, all of the prior art references relied upon by the Examiner simply do not teach the 
aforementioned specific functionality claimed by applicant which is conditioned specifically after 
stopping the forwarding of said packets, and after the attack has stopped, as claimed. 

To establish a prima facie case of obviousness, three basic criteria must be met. First, there 
must be some suggestion or motivation, either in the references themselves or in the knowledge 
generally available to one of ordinary skill in the art, to modify the reference or to combine reference 
teachings. Second, there must be a reasonable expectation of success. Finally, the prior art reference 
(or references when combined) must teach or suggest all the claim limitations. The teaching or 
suggestion to make the claimed combination and the reasonable expectation of success must both be 
found in the prior art and not based on applicant's disclosure. In re VaecK9Al F.2d 488, 20 USPQ2d 
1438 (Fed.Cir.1991). 
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Applicant respectfully asserts that at least the first and third elements of the prima facie case 
of obviousness have still not been met. For example, with respect to the third element of ^ prima 
facie case of obvious, such element has not been met since the prior art references, when combined, 
fail to teach or suggest all of the claim limitations, as noted above. A notice of allowance or a 
specific prior art showing of all of applicant's claim limitations, in combination with the remaining 
claim elements, is respectfully requested. 

Thus, all of the independent claims are deemed allowable. Moreover, the remaining 
dependent claims are further deemed allowable, in view of their dependence on such independent 
claims. 

In the event a telephone conversation would expedite the prosecution of this application, the 
Examiner may reach the undersigned at (408) 505-5 100. The Commissioner is authorized to charge 
any additional fees or credit any overpayment to Deposit Account No. 50-1351 (Order No. 
NAI1P310). 

Rcspectfo^y/subrmtted, 
Zilka-Ko 



Kevin 

P.O. Box 721 120 RcgistratjoyNo. 41,429 

San Jose, CA 95 172- 1120 
40&-505-5100 
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